حل مشكلة whm SSH direct root logins are permitted - password authentication [الأرشيف]

Rise Company

14-01-2020, 01:31

حل مشكلة whm SSH direct root logins are permitted
WHM Terminal and sshd-config setting PermitRootLogin to no
PermitRootLogin to “without-password” or “no”What is the different?
الفرق بين PermitRootLogin"without-password" vs "no"

https://www.rise.company/upload/uploads/157896203266022.png

رسالة تنبيه Security Advisor

Manually edit /etc/ssh/sshd_config and change PermitRootLogin to “without-password” or “no”, then restart SSH in the “Restart SSH” area

-------------------------------------------------------------
اهمية الحماية direct root logins are permitted
-------------------------------------------------------------

A dictionary attack uses a brute-force technique of successively trying all the words in an exhaustive list called a dictionary (from a pre-arranged list of values). In contrast with a normal brute force attack, where a large proportion key space is searched systematically, a dictionary attack tries only those possibilities which are most likely to succeed, typically derived from a list of words for example a dictionary (hence the phase dictionary attack) or a bible etc. Generally, dictionary attacks succeed because many people have a tendency to choose passwords which are short (7 characters or fewer), single words found in dictionaries or simple, easily-predicted variations on words, such as appending a digit.

If an attacker wants to break your server, he first needs to guess the username, and then try to gess the password for that username, so the more common dictionary attacks are done to the root password, there are two reasons to do it that way.

Almost all systems has root accounts (Ubuntu does not have it enabled)
If someone gain access to your server with the root accout it will have full access to the server

-------------------------------------------------------------
هناك طريقتين لحماية Root Account فى الشيل
-------------------------------------------------------------
So there are two simple ways to avoid the possibility of an attack to the root account
PermitRootLogin to “without-password” or “no”What is the different?

قم بفتح terminal ثم ضع هذا الامر

nano /etc/ssh/sshd_config

ثم ابحث عن PermitRootLogin yes وقم بتبديل yes
اما “without-password” or “no”
ولا ننصح بعمل no لاتعمل بعد ريستارت السيرفر

https://www.rise.company/upload/uploads/163849735764971.png

-------------------------------------------------------------
الطريقة الاولي : PermitRootLogin without-password
-------------------------------------------------------------
الميزة : يتم استخدام حساب root الافتراضي
Enable root access via ssh, but only with rsa key

without-password

https://www.rise.company/upload/uploads/157896325137582.png

Edit the file /etc/ssh/sshd_config Look for this line
#PermitRootLogin yes
And change it to: PermitRootLogin without-password

* ملحوظة قم يحذف # لكي يفعل الامر

allows root, but *only* if keys are set up, or another form of authentication,'
but *not* password authentication; - it will deny even a valid password.

-------------------------------------------------------------
الطريقة الثانية : PermitRootLogin no
-------------------------------------------------------------
تسبب مشاكل لا ننصح بها

الميزة : لايتم استخدام حساب root الافتراضي وهيتطلب اعطاء صلاحيات لحساب اخر
Disable root access via ssh to your server

https://www.rise.company/upload/uploads/157896325130121.png

Edit the file /etc/ssh/sshd_config Look for this line
#PermitRootLogin yes
And change it to: PermitRootLogin no

* ملحوظة قم يحذف # لكي يفعل الامر

denies root all the time, even if keys have been set up for equivalence.

-------------------------------------------------------------
عمل حساب بديل للـ root له كامل الصلاحيات من خلال Manage Wheel Group Users
-------------------------------------------------------------

https://www.youtube.com/watch?v=s1E0h_GbYMU

ملحوظة : تنفيذ الحماية لا يؤثر ولا يغلق Terminal وستتمتع به داخل whm

ننصح بالطريقة الاولي لكي تكون الخطوات اسهل عليك وغير معقدة
بجانب حماية الشيل مع تغيير رقم البورت + مفتاح الدخول المولد بتكون الحماية قوية
فى النهاية هيكون الحماية للشيل تم تنفيذها ورسالة التنبيه فى cPanel Security Advisor اختفت.

شاهد ايضا :
حل مشكلة الشيل SSH Access Denied وخطا whm putty no authentication methods available (https://www.rise.company/forum/threads/80438-%D8%AD%D9%84-%D9%85%D8%B4%D9%83%D9%84%D8%A9-%D8%A7%D9%84%D8%B4%D9%8A%D9%84-SSH-Access-Denied-%D9%88%D8%AE%D8%B7%D8%A7-whm-putty-no-authentication-methods-available)

شرح توليد مفتاح Public/Private Key فى برنامج putty للشيل whm (https://www.rise.company/forum/threads/52094-%D8%B4%D8%B1%D8%AD-%D8%AA%D9%88%D9%84%D9%8A%D8%AF-%D9%85%D9%81%D8%AA%D8%A7%D8%AD-Public-Private-Key-%D9%81%D9%89-%D8%A8%D8%B1%D9%86%D8%A7%D9%85%D8%AC-putty-%D9%84%D9%84%D8%B4%D9%8A%D9%84-whm)

شرح تغيير بورت الشيل change SSH Port with WHM & CSF (https://www.rise.company/forum/threads/52141-%D8%B4%D8%B1%D8%AD-%D8%AA%D8%BA%D9%8A%D9%8A%D8%B1-%D8%A8%D9%88%D8%B1%D8%AA-%D8%A7%D9%84%D8%B4%D9%8A%D9%84-change-SSH-Port-with-WHM-CSF)
شرح انشاء مفتاح Generate private and public key in cPanel for SSH access (https://www.rise.company/forum/threads/52092-%D8%B4%D8%B1%D8%AD-%D8%A7%D9%86%D8%B4%D8%A7%D8%A1-%D9%85%D9%81%D8%AA%D8%A7%D8%AD-Generate-private-and-public-key-in-cPanel-for-SSH-access)

شرح تعطيل و تفعيل Disable Root Logins & Replace With SSH Key (https://www.rise.company/forum/threads/52091-%D8%B4%D8%B1%D8%AD-%D8%AA%D8%B9%D8%B7%D9%8A%D9%84-%D9%88-%D8%AA%D9%81%D8%B9%D9%8A%D9%84-Disable-Root-Logins-Replace-With-SSH-Key)

Rise Company

14-01-2020, 02:46

This is a common misunderstanding for the PermitRootLogin feature. The without-password option does not mean there is no authentication and anyone can get in without a password. All this option means is that logging in is only possible using a fallback method, such as public key authentication. Even if an attacker knows your root password, they will not be able to log in unless they have your private key.
It is actually better to use without-password if you need to log in as root, since it ensures that the root account cannot be brute forced. If you were to log in as root with a password, it could be subject to being remotely attacked, whereas public key authentication ensures you can only log in with the proper credential files. This is better than logging in as a different user and using su to elevate to root, as a compromise of that other user would result in a compromised root, since the user can monitor any keystrokes entered into its shell. This is explained in detail in the answer to Which is the safest way to get root privileges: sudo, su or login? (https://unix.stackexchange.com/questions/8581/which-is-the-safest-way-to-get-root-privileges-sudo-su-or-login).
If you do not need to have root, then using another, dedicated user would be fine. In this case, setting PermitRootLogin no would be beneficial, as there is no reason to have root access if not required.